Protections for Youth on Social Media

Second Regular Session Seventy-fifth General Assembly STATE OF COLORADO INTRODUCED HOUSE BILL 26-1148 LLS NO. 26-0293.02 Richard Sweetman x4333 HOUSE SPONSORSHIP Zokaie and Willford, SENATE SPONSORSHIP Weissman and Roberts, House Committees Senate Committees Judiciary A BILL FOR AN ACT CONCERNING PROTECTIONS FOR MINORS WHO ACCESS CERTAIN SOCIAL MEDIA.

Bill Summary (Note: This summary applies to this bill as introduced and does not reflect any amendments that may be subsequently adopted. If this bill passes third reading in the house of introduction, a bill summary that applies to the reengrossed version of this bill will be available at http://leg.colorado.gov.) Under the bill, a "covered business" is defined as a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate of such a legal entity, that: ! Conducts business in the state and generates a majority of its annual revenue from online services; Shading denotes HOUSE amendment. Double underlining denotes SENATE amendment.

Capital letters or bold & italic numbers indicate new material to be added to existing law. Dashes through the words or numbers indicate deletions from existing law.

Makes available online gaming services, products, or features that are reasonably likely to be accessed by a user who is a minor or who the covered business labels as a minor (covered minor); ! Collects users' personal data or has users' personal data collected on its behalf by a processor; and ! Solely or jointly with others determines the purposes and means of the processing of users' personal data. The bill states that a covered business that processes the personal data of a covered minor owes a minimum duty of care to the covered minor. The bill also requires a covered business to: ! Configure default privacy settings provided to a covered minor to the highest level of privacy and to include certain default settings; ! Provide a prominent, accessible, and responsive tool to allow a covered minor to request that the covered minor's account be unpublished or deleted and, if the business receives such a request, to honor it within 15 days; and ! Immediately delete all data that relates to the determination of a user's age after it is determined that the user is a covered minor. The bill prohibits a covered business from: ! Providing a covered minor with a single setting that makes all of the default privacy settings less protective at once; ! Requesting or prompting a covered minor to make their privacy settings less protective; ! Collecting, selling, sharing, or retaining personal data of a covered minor that is not necessary to provide an online gaming service, product, or feature with which the covered minor is actively and knowingly engaged; ! Using previously collected personal data of a covered minor for any purpose other than a purpose for which the personal data was collected; ! Permitting an individual to monitor the online activity of a covered minor or to track the location of the covered minor without providing a conspicuous signal to the covered minor when the covered minor is being monitored or tracked; ! Using the personal data of a covered minor to select, recommend, or prioritize media for the covered minor unless the covered minor makes certain requests or takes certain actions warranting such conduct by the covered business; or ! Sending push notifications to a covered minor between 12 midnight and 6 a.m. ! The bill imposes additional specific requirements and prohibitions for a covered business that collects users' personal data for the purpose of conducting age assurance. The bill requires a covered business to ensure that the purchase price for an online gaming service, product, or feature that is made available through the covered business's online gaming service, product, or feature and that is reasonably likely to be accessed by a covered minor is listed in United States dollars at the point of sale. A covered business shall impose and collect a fee on each add-on transaction that is conducted by a covered minor through the covered business's online gaming service, product, or feature. The amount of the fee is 5% of the amount of the transaction. Money collected as such fees is credited to the state public school fund. The bill requires a social media platform to provide certain information on its website or mobile application concerning privacy policies and the use of algorithms. A social media platform is prohibited from using an algorithmic recommendation system to sell or otherwise distribute an illicit substance to a covered minor.

Be it enacted by the General Assembly of the State of Colorado: SECTION 1. In Colorado Revised Statutes, add part 19 to article 1 of title 6 as follows:

PART 19 PROTECTIONS FOR MINORS ON ONLINE GAMING SITES

6-1-1901. Definitions.

AS USED IN THIS PART 19, UNLESS THE CONTEXT OTHERWISE REQUIRES:

(1) "ADD-ON TRANSACTION" MEANS AN ONLINE TRANSACTION THROUGH WHICH A PLAYER OR PARTICIPANT IN AN ONLINE GAMING SERVICE, PRODUCT, OR FEATURE ACQUIRES:

(a) AN ITEM OR ABILITY THAT PROVIDES THE PLAYER OR PARTICIPANT AN ADVANTAGE OVER OTHER PLAYERS OR PARTICIPANTS; OR

(b) A FEATURE THAT ALTERS OR ENHANCES THE ONLINE GAMING SERVICE, PRODUCT, OR FEATURE.

(3) "AGE ASSURANCE" MEANS A DETERMINATION, AN ESTIMATION, OR A COMMUNICATION ABOUT THE AGE OR AGE RANGE OF A USER.

"AFFILIATE" HAS THE MEANING SET FORTH IN SECTION

(4) "BUSINESS ASSOCIATE" HAS THE MEANING SET FORTH IN 45 CFR 160.103.

(5) "COLLECT" MEANS TO BUY, RENT, GATHER, OBTAIN, RECEIVE, OR ACCESS PERSONAL DATA BY ANY MEANS, INCLUDING BY RECEIVING DATA, EITHER ACTIVELY OR PASSIVELY, FROM A CONSUMER OR BY OBSERVING A CONSUMER'S BEHAVIOR.

(6) "COMPULSIVE USE" MEANS THE REPETITIVE USE OF A COVERED BUSINESS'S ONLINE GAMING SERVICE, PRODUCT, OR FEATURE, WHICH USE:

(a) MATERIALLY DISRUPTS ONE OR MORE MAJOR LIFE ACTIVITIES OF A MINOR, INCLUDING SLEEPING, EATING, LEARNING, READING, CONCENTRATING, COMMUNICATING, OR WORKING; OR

(b) SUBVERTS OR IMPAIRS A COVERED MINOR'S AUTONOMY, DECISION-MAKING, OR CHOICE DURING THE USE OF THE ONLINE GAMING SERVICE, PRODUCT, OR FEATURE.

(7) "COVERED BUSINESS" MEANS A SOLE PROPRIETORSHIP, A PARTNERSHIP, A LIMITED LIABILITY COMPANY, A CORPORATION, AN ASSOCIATION, OR ANOTHER LEGAL ENTITY, OR AN AFFILIATE THEREOF, THAT:

(a) CONDUCTS BUSINESS IN THIS STATE;

(b) GENERATES A MAJORITY OF ITS ANNUAL REVENUE FROM ONLINE SERVICES;

(c) MAKES AVAILABLE ONLINE GAMING SERVICES, PRODUCTS, OR FEATURES THAT ARE REASONABLY LIKELY TO BE ACCESSED BY A COVERED MINOR;

(d) COLLECTS USERS' PERSONAL DATA OR HAS USERS' PERSONAL DATA COLLECTED ON ITS BEHALF BY A PROCESSOR; AND

(e) SOLELY OR JOINTLY WITH OTHERS DETERMINES THE PURPOSES AND MEANS OF THE PROCESSING OF USERS' PERSONAL DATA.

(8) "COVERED MINOR" MEANS A USER WHO A COVERED BUSINESS KNOWS IS A MINOR OR LABELS AS A MINOR PURSUANT TO AGE ASSURANCE.

(9) "DE-IDENTIFIED DATA" HAS THE MEANING SET FORTH IN

SECTION 6-1-1303 (11).

(10) "MINIMUM DUTY OF CARE" MEANS ENSURING THAT THE USE OF THE PERSONAL DATA OF A COVERED MINOR AND THE DESIGN OF AN ONLINE GAMING SERVICE, PRODUCT, OR FEATURE WILL NOT RESULT IN:

(a) COVERED MINOR;

REASONABLY FORESEEABLE EMOTIONAL DISTRESS TO A

(b) REASONABLY FORESEEABLE COMPULSIVE USE OF THE ONLINE GAMING SERVICE, PRODUCT, OR FEATURE BY A COVERED MINOR; OR

(c) DISCRIMINATION AGAINST A COVERED MINOR BASED UPON RACE, ETHNICITY, SEX, DISABILITY, SEXUAL ORIENTATION, GENDER IDENTITY, GENDER EXPRESSION, RELIGION, OR NATIONAL ORIGIN.

(11) "MINOR" MEANS A USER WHO IS UNDER EIGHTEEN YEARS OLD.

(12) "ONLINE GAMING SERVICE, PRODUCT, OR FEATURE" MEANS AN ONLINE SERVICE, PRODUCT, OR FEATURE, AS DEFINED IN SECTION 6-1-1303 (16.8), THAT IS INTENDED TO FACILITATE ONLINE GAMING.

(13) "PERSONAL DATA" HAS THE MEANING SET FORTH IN SECTION 6-1-1303 (17). (14) "PROCESS" OR "PROCESSING" HAS THE MEANING SET FORTH IN SECTION 6-1-1303 (18).

(15) "PROCESSOR" HAS THE MEANING SET FORTH IN SECTION 6-1-1303 (19).

(16) "REASONABLY LIKELY TO BE ACCESSED BY A COVERED MINOR" MEANS AN ONLINE GAMING SERVICE, PRODUCT, OR FEATURE THAT IS REASONABLY LIKELY TO BE ACCESSED BY A COVERED MINOR BASED ON ANY OF THE FOLLOWING INDICATORS:

(a) THE ONLINE GAMING SERVICE, PRODUCT, OR FEATURE IS DIRECTED TO CHILDREN, AS DESCRIBED BY THE FEDERAL "CHILDREN'S ONLINE PRIVACY PROTECTION ACT OF 1998", 15 U.S.C. SECS. 6501 TO 6506, AND THE ASSOCIATED RULES OF THE FEDERAL TRADE COMMISSION;

(b) THE ONLINE GAMING SERVICE, PRODUCT, OR FEATURE IS DETERMINED, BASED ON COMPETENT AND RELIABLE EVIDENCE REGARDING AUDIENCE COMPOSITION, TO BE ROUTINELY ACCESSED BY AN AUDIENCE THAT IS COMPOSED OF AT LEAST TWO PERCENT MINORS WHO ARE TWO THROUGH SEVENTEEN YEARS OLD;

(c) THE AUDIENCE OF THE ONLINE GAMING SERVICE, PRODUCT, OR FEATURE IS DETERMINED, BASED ON INTERNAL COMPANY RESEARCH, TO BE COMPOSED OF AT LEAST TWO PERCENT MINORS WHO ARE TWO THROUGH SEVENTEEN YEARS OLD; OR

(d) THE COVERED BUSINESS KNEW OR SHOULD HAVE KNOWN THAT AT LEAST TWO PERCENT OF THE AUDIENCE OF THE ONLINE GAMING SERVICE, PRODUCT, OR FEATURE IS COMPOSED OF MINORS WHO ARE TWO THROUGH SEVENTEEN YEARS OLD; EXCEPT THAT, IN MAKING THIS ASSESSMENT, THE BUSINESS SHALL NOT COLLECT OR PROCESS ANY PERSONAL DATA THAT IS NOT REASONABLY NECESSARY TO PROVIDE AN ONLINE GAMING SERVICE, PRODUCT, OR FEATURE WITH WHICH A MINOR IS ACTIVELY AND KNOWINGLY ENGAGED.

(17) "USER" MEANS A USER OF ONE OR MORE ONLINE GAMING SERVICES, PRODUCTS, OR FEATURES WHO RESIDES IN THE STATE.

6-1-1902. Minimum duty of care.

(1) ON AND AFTER DECEMBER 1, 2026, A COVERED BUSINESS THAT PROCESSES A COVERED MINOR'S PERSONAL DATA IN ANY CAPACITY OWES A MINIMUM DUTY OF CARE TO THE COVERED MINOR.

(2) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO REQUIRE A COVERED BUSINESS TO PREVENT OR PRECLUDE A COVERED MINOR FROM ACCESSING OR VIEWING ANY ITEM OF MEDIA OR CATEGORY OF MEDIA.

6-1-1903. Default privacy settings required - tool for timely deletion of accounts required.

(1) Default privacy settings.

(a) ON AND AFTER DECEMBER 1, 2026, A COVERED BUSINESS SHALL CONFIGURE ALL DEFAULT PRIVACY SETTINGS PROVIDED TO A COVERED MINOR THROUGH AN ONLINE GAMING SERVICE, PRODUCT, OR FEATURE TO THE HIGHEST LEVEL OF PRIVACY, INCLUDING THE FOLLOWING DEFAULT SETTINGS:

(I) NOT DISPLAYING THE EXISTENCE OF THE COVERED MINOR'S ACCOUNT TO AN ADULT USER UNLESS THE COVERED MINOR EXPRESSLY AND UNAMBIGUOUSLY ALLOWS THE ADULT USER TO VIEW THE COVERED MINOR'S UNAMBIGUOUSLY CHOOSES TO MAKE THEIR ACCOUNT'S EXISTENCE PUBLIC;

(II) NOT DISPLAYING MEDIA CREATED OR POSTED BY THE COVERED MINOR TO AN ADULT USER UNLESS THE COVERED MINOR EXPRESSLY AND UNAMBIGUOUSLY ALLOWS THE ADULT USER TO VIEW THE COVERED MINOR ' S UNAMBIGUOUSLY CHOOSES TO MAKE THEIR MEDIA PUBLICLY AVAILABLE;

ACCOUNT MEDIA OR OR THE THE COVERED COVERED MINOR MINOR EXPRESSLY EXPRESSLY AND AND

(III) NOT PERMITTING AN ADULT USER TO LIKE, COMMENT ON, OR OTHERWISE PROVIDE FEEDBACK ON THE COVERED MINOR'S MEDIA UNLESS THE COVERED MINOR EXPRESSLY AND UNAMBIGUOUSLY ALLOWS THE ADULT USER TO DO SO;

(IV) NOT PERMITTING DIRECT MESSAGING BETWEEN THE COVERED MINOR AND AN ADULT USER UNLESS THE COVERED MINOR EXPRESSLY AND UNAMBIGUOUSLY ALLOWS DIRECT MESSAGING WITH THE ADULT USER;

(V) NOT DISPLAYING THE COVERED MINOR'S LOCATION TO OTHER USERS UNLESS THE COVERED MINOR EXPRESSLY AND UNAMBIGUOUSLY SHARES THEIR LOCATION WITH A SPECIFIC USER;

(VI) NOT DISPLAYING TO ANY USER THE USERS WHO ARE CONNECTED TO THE COVERED MINOR UNLESS THE COVERED MINOR EXPRESSLY AND UNAMBIGUOUSLY CHOOSES TO SHARE THE INFORMATION WITH THE USER;

(VII) DISABLING SEARCH ENGINE INDEXING OF THE COVERED MINOR'S ACCOUNT PROFILE; AND

(VIII) NOT SENDING PUSH NOTIFICATIONS TO THE COVERED MINOR.

(b) ON AND AFTER DECEMBER 1, 2026, A COVERED BUSINESS SHALL NOT:

(I) PROVIDE A COVERED MINOR WITH A SINGLE SETTING THAT MAKES ALL OF THE DEFAULT PRIVACY SETTINGS LESS PROTECTIVE AT ONCE; OR

(II) REQUEST OR PROMPT A COVERED MINOR TO MAKE THEIR PRIVACY SETTINGS LESS PROTECTIVE.

(2) Timely deletion of account. ON AND AFTER DECEMBER 1, 2026, A COVERED BUSINESS SHALL: (a) PROVIDE A PROMINENT, ACCESSIBLE, AND RESPONSIVE TOOL TO ALLOW A COVERED MINOR TO REQUEST THAT THE COVERED MINOR'S ACCOUNT BE UNPUBLISHED OR DELETED; AND

(b) HONOR A REQUEST DESCRIBED IN SUBSECTION (2)(a) OF THIS SECTION NOT LATER THAN FIFTEEN DAYS AFTER THE COVERED BUSINESS RECEIVES THE REQUEST.

6-1-1904. Prohibited data and design practices - data privacy - compulsive use. (1) Data privacy. ON AND AFTER DECEMBER 1, 2026, A COVERED BUSINESS SHALL NOT:

(a) COLLECT, SELL, SHARE, OR RETAIN PERSONAL DATA OF A COVERED MINOR THAT IS NOT NECESSARY TO PROVIDE AN ONLINE GAMING SERVICE, PRODUCT, OR FEATURE WITH WHICH THE COVERED MINOR IS ACTIVELY AND KNOWINGLY ENGAGED;

(b) USE PREVIOUSLY COLLECTED PERSONAL DATA OF A COVERED MINOR FOR ANY PURPOSE OTHER THAN A PURPOSE FOR WHICH THE PERSONAL DATA WAS COLLECTED, UNLESS SUCH USE IS NECESSARY TO COMPLY WITH AN OBLIGATION UNDER THIS PART 19;

(c) PERMIT AN INDIVIDUAL, INCLUDING A PARENT OR GUARDIAN OF A COVERED MINOR, TO MONITOR THE ONLINE ACTIVITY OF A COVERED MINOR OR TO TRACK THE LOCATION OF THE COVERED MINOR WITHOUT PROVIDING A CONSPICUOUS SIGNAL TO THE COVERED MINOR WHEN THE COVERED MINOR IS BEING MONITORED OR TRACKED;

(d) USE THE PERSONAL DATA OF A COVERED MINOR TO SELECT, RECOMMEND, OR PRIORITIZE MEDIA FOR THE COVERED MINOR, UNLESS:

(I) THE COVERED MINOR EXPRESSLY AND UNAMBIGUOUSLY REQUESTS TO RECEIVE:

(A) MEDIA FROM A SPECIFIC ACCOUNT, FEED, OR USER OR TO RECEIVE MORE OR LESS MEDIA FROM AN ACCOUNT, FEED, OR USER; OR

(B) A SPECIFIC CATEGORY OF MEDIA OR TO SEE MORE OR LESS OF A SPECIFIC CATEGORY OF MEDIA;

(II) THE PERSONAL DATA IS USED TO SET OR RESET PRIVACY OR ACCESSIBILITY SETTINGS; OR

(III) THE PERSONAL DATA IS USED TO PRIORITIZE MEDIA IN RESPONSE TO A SEARCH QUERY BY THE COVERED MINOR; OR

(e) SEND PUSH NOTIFICATIONS TO A COVERED MINOR BETWEEN 12 MIDNIGHT AND 6 A.M.

(2) Compulsive use. ON AND AFTER DECEMBER 1, 2026, A COVERED BUSINESS SHALL NOT IMPLEMENT DATA PROCESSING OR DESIGN PRACTICES THAT LEAD TO COMPULSIVE USE OF AN ONLINE GAMING SERVICE, PRODUCT, OR FEATURE.

6-1-1905. Privacy protections for age assurance data.

(1) ON AND AFTER DECEMBER 1, 2026, WHEN CONDUCTING AGE ASSURANCE, A COVERED BUSINESS OR PROCESSOR SHALL:

(a) COLLECT ONLY THE PERSONAL DATA OF A USER THAT IS NECESSARY FOR THE PURPOSE OF AGE ASSURANCE;

(b) UPON DETERMINING THAT A USER IS A COVERED MINOR, IMMEDIATELY DELETE ALL DATA THAT RELATES TO THE DETERMINATION OF THE USER'S AGE;

(c) NOT USE A USER'S PERSONAL DATA FOR ANY PURPOSE OTHER THAN AGE ASSURANCE;

(d) NOT COMBINE A USER'S PERSONAL DATA WITH ANY OTHER USER'S PERSONAL DATA, EXCEPT FOR THE PURPOSE OF AGGREGATING DE-IDENTIFIED DATA;

(e) NOT DISCLOSE A USER'S PERSONAL DATA TO A THIRD PARTY THAT IS NOT A PROCESSOR; AND

(f) IMPLEMENT A REVIEW PROCESS TO ALLOW A USER TO APPEAL THE DETERMINATION OF THEIR AGE.

6-1-1906. Transactions involving covered minors - prices to be listed in U.S. dollars - fees for add-on transactions.

(1) A COVERED BUSINESS SHALL ENSURE THAT THE PURCHASE PRICE FOR AN ONLINE GAMING SERVICE, PRODUCT, OR FEATURE THAT IS MADE AVAILABLE THROUGH THE COVERED BUSINESS'S ONLINE GAMING SERVICE, PRODUCT, OR FEATURE AND THAT IS REASONABLY LIKELY TO BE ACCESSED BY A COVERED MINOR IS LISTED IN UNITED STATES DOLLARS AT THE POINT OF SALE.

(2) A COVERED BUSINESS SHALL IMPOSE AND COLLECT A FEE ON EACH ADD-ON TRANSACTION THAT IS CONDUCTED BY A COVERED MINOR THROUGH THE COVERED BUSINESS'S ONLINE GAMING SERVICE, PRODUCT, OR FEATURE. THE AMOUNT OF THE FEE IS FIVE PERCENT OF THE AMOUNT OF THE TRANSACTION. A COVERED BUSINESS SHALL TRANSFER MONEY COLLECTED AS FEES PURSUANT TO THIS SUBSECTION (2) TO THE STATE TREASURER, WHO SHALL CREDIT THE MONEY TO THE STATE PUBLIC SCHOOL FUND CREATED IN SECTION 22-54-114.

6-1-1907. Enforcement - unfair or deceptive trade practice.

A COVERED BUSINESS OR PROCESSOR THAT VIOLATES THIS PART 19 OR RULES ADOPTED PURSUANT TO THIS PART 19 COMMITS AN UNFAIR OR DECEPTIVE TRADE PRACTICE AS DESCRIBED IN SECTION 6-1-105 (1)(qqqq).

6-1-1908. Limitations and exclusions.

CONSTRUED TO:

NOTHING IN THIS PART 19 SHALL BE INTERPRETED OR

(a) IMPOSE LIABILITY IN A MANNER THAT IS INCONSISTENT WITH 47 U.S.C. SEC. 230; OR (b) PREVENT OR PRECLUDE A COVERED MINOR FROM DELIBERATELY OR INDEPENDENTLY SEARCHING FOR, OR SPECIFICALLY REQUESTING, ANY MEDIA.

(2) THIS PART 19 DOES NOT APPLY TO:

(a) A FEDERAL, STATE, TRIBAL, OR LOCAL GOVERNMENT ENTITY IN THE ORDINARY COURSE OF ITS OPERATION;

(b) PROTECTED HEALTH INFORMATION THAT A COVERED BUSINESS OR BUSINESS ASSOCIATE PROCESSES IN ACCORDANCE WITH, OR DOCUMENTS THAT A COVERED BUSINESS OR BUSINESS ASSOCIATE CREATES FOR THE PURPOSE OF COMPLYING WITH, THE FEDERAL INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996", PUB.L.

(c) "HEALTH INFORMATION THAT IS USED ONLY FOR PUBLIC HEALTH ACTIVITIES AS DESCRIBED IN 45 CFR 164.512; OR

(d) INFORMATION THAT IDENTIFIES A USER IN CONNECTION WITH:

(I) ACTIVITIES THAT ARE SUBJECT TO THE "FEDERAL POLICY FOR THE PROTECTION OF HUMAN SUBJECTS", AS SET FORTH IN 45 CFR 46;

(II) RESEARCH ON HUMAN SUBJECTS UNDERTAKEN IN ACCORDANCE WITH GOOD CLINICAL PRACTICE GUIDELINES ISSUED BY THE INTERNATIONAL COUNCIL REQUIREMENTS FOR PHARMACEUTICALS FOR HUMAN USE OR ITS SUCCESSOR ORGANIZATION;

FOR HARMONISATION OF TECHNICAL

(III) ACTIVITIES THAT ARE PROTECTED UNDER 21 CFR 50 AND 56;

(IV) RESEARCH CONDUCTED IN ACCORDANCE WITH THE REQUIREMENTS SET FORTH IN SUBSECTION (2)(d)(III) OF THIS SECTION OR OTHERWISE IN ACCORDANCE WITH STATE (2)(d)(I), (2)(d)(II), OR OR FEDERAL LAW;

(V) AN ENTITY WITH A PRIMARY PURPOSE OF JOURNALISM AND A WORKFORCE WHOSE MAJORITY CONSISTS OF INDIVIDUALS ENGAGING IN JOURNALISM; OR

(VI) A FINANCIAL INSTITUTION SUBJECT TO TITLE V OF THE FEDERAL "GRAMM-LEACH-BLILEY ACT", PUB.L. 106-102, REGULATIONS ADOPTED TO IMPLEMENT THAT ACT.

AND

6-1-1909. Rights and freedoms of covered minors.

NOTHING IN THIS PART 19 SHALL BE CONSTRUED TO INFRINGE ON THE RIGHTS AND FREEDOMS OF COVERED MINORS OR BE CONSTRUED TO DISCRIMINATE AGAINST A COVERED MINOR BASED ON RACE, ETHNICITY, SEX, DISABILITY, SEXUAL ORIENTATION, GENDER IDENTITY, GENDER EXPRESSION, RELIGION, OR NATIONAL ORIGIN.

6-1-1910. Rules.

THE ATTORNEY GENERAL MAY ADOPT RULES FOR THE IMPLEMENTATION OF THIS PART 19, INCLUDING RULES ESTABLISHING PERMISSIBLE METHODS BY WHICH A COVERED BUSINESS MAY DETERMINE THE AGE OF A COVERED MINOR.

SECTION 2.

(1)(qqqq) as follows:

In Colorado Revised Statutes, 6-1-105, add

6-1-105. Unfair or deceptive trade practices - definitions.

(1) A person engages in a deceptive trade practice when, in the course of the person's business, vocation, or occupation, the person:

(qqqq) VIOLATES PART 19 OF THIS ARTICLE 1.

SECTION 3. In Colorado Revised Statutes, add 6-1-1602 and 6-1-1603 as follows: 6-1-1602. Transparency - privacy - disclosures regarding the use of algorithmic recommendation systems - definitions.

(1) ON AND AFTER DECEMBER 1, 2026, A SOCIAL MEDIA PLATFORM SHALL PROMINENTLY AND CLEARLY PROVIDE ON ITS WEBSITE OR MOBILE APPLICATION:

(a) THE SOCIAL MEDIA PLATFORM'S TERMS OF SERVICE, POLICIES, AND COMMUNITY STANDARDS;

(b) THE SOCIAL MEDIA PLATFORM'S POLICIES CONCERNING USERS' PRIVACY;

(c) THE PURPOSE OF EACH ALGORITHMIC RECOMMENDATION SYSTEM IN USE BY THE SOCIAL MEDIA PLATFORM;

(d) INPUTS USED BY EACH ALGORITHMIC RECOMMENDATION SYSTEM IN USE BY THE SOCIAL MEDIA PLATFORM, INCLUDING HOW EACH INPUT:

(I) IS MEASURED OR DETERMINED;

(II) USES THE PERSONAL DATA OF MINOR USERS;

(III) INFLUENCES A RECOMMENDATION ISSUED BY THE SYSTEM;

AND

(IV) IS WEIGHED RELATIVE TO THE OTHER INPUTS DESCRIBED IN THIS SUBSECTION (1)(d); AND

(e) FOR EVERY FEATURE OF A WEBSITE OR MOBILE APPLICATION THAT USES THE PERSONAL DATA OF A MINOR USER, DESCRIPTIONS OF:

(I) THE PURPOSE OF THE WEBSITE OR MOBILE APPLICATION;

(II) THE PERSONAL DATA COLLECTED BY THE WEBSITE OR MOBILE APPLICATION;

(III) THE PERSONAL DATA USED BY THE WEBSITE OR MOBILE APPLICATION;

(IV) HOW THE PERSONAL DATA IS USED BY THE WEBSITE OR MOBILE APPLICATION;

(V) ANY PERSONAL DATA TRANSFERRED TO OR SHARED WITH A PROCESSOR OR THIRD PARTY BY THE WEBSITE OR MOBILE APPLICATION, THE IDENTITY OF THE PROCESSOR OR THIRD PARTY, AND THE PURPOSE OF THE TRANSFER OR SHARING; AND

(VI) HOW LONG THE PERSONAL DATA IS RETAINED BY THE WEBSITE OR MOBILE APPLICATION.

(2) AS USED IN THIS SECTION, UNLESS THE CONTEXT OTHERWISE REQUIRES:

(a) "ALGORITHMIC RECOMMENDATION SYSTEM" MEANS A SYSTEM THAT USES AN ALGORITHM TO SELECT, FILTER, AND ARRANGE MEDIA ON A SOCIAL MEDIA PLATFORM'S WEBSITE OR MOBILE APPLICATION FOR THE PURPOSE OF SELECTING, RECOMMENDING, OR PRIORITIZING MEDIA FOR A USER.

(b) "MINOR USER" MEANS A USER OF A SOCIAL MEDIA PLATFORM WHO IS UNDER EIGHTEEN YEARS OLD.

(c) "PERSONAL DATA" HAS THE MEANING SET FORTH IN SECTION 6-1-1303 (17). (d) "PROCESSOR" HAS THE MEANING SET FORTH IN SECTION 6-1-1303 (19). (e) "SOCIAL MEDIA PLATFORM" HAS THE MEANING SET FORTH IN SECTION 6-1-1601 (4).

6-1-1603. Use of algorithmic recommendation systems for sales of illicit substances to minors prohibited - definitions.

(1) A SOCIAL MEDIA PLATFORM SHALL NOT USE AN ALGORITHMIC RECOMMENDATION SYSTEM TO SELL OR OTHERWISE DISTRIBUTE AN ILLICIT SUBSTANCE TO A MINOR USER.

(2) AS USED IN THIS SECTION, UNLESS THE CONTEXT OTHERWISE REQUIRES:

(a) "ALGORITHMIC RECOMMENDATION SYSTEM" HAS THE MEANING SET FORTH IN SECTION 6-1-1602 (2)(a).

(b) (I) "ILLICIT SUBSTANCE" MEANS:

(A) A CONTROLLED SUBSTANCE, AS DEFINED IN SECTION

(B) A HEMP PRODUCT, AS DEFINED IN SECTION 25-5-427 (2)(d), THAT IS NOT A TINCTURE OR COSMETIC AND HAS MORE THAN ONE AND ONE-FOURTH MILLIGRAMS OF THC, AS DEFINED IN SECTION 44-10-209 (2)(d), PER SERVING OR HAS A RATIO OF CANNABIDIOL TO THC OF LESS THAN TWENTY TO ONE; AND

(C) A PRODUCT THAT CONTAINS HEMP THAT IS INTENDED FOR HUMAN CONSUMPTION AND IS NOT A COSMETIC, A DIETARY SUPPLEMENT, A FOOD, A FOOD ADDITIVE, OR AN HERB.

(II) NOTWITHSTANDING SUBSECTION (2)(b)(I) OF THIS SECTION, "ILLICIT SUBSTANCE" DOES NOT INCLUDE:

(A) A PRODUCT THAT MAY BE PRODUCED AND SOLD IN COLORADO PURSUANT TO AND IN COMPLIANCE WITH SECTION 25-5-427, ARTICLE 10 OF TITLE 44, AND RULES ADOPTED PURSUANT TO SUCH PROVISIONS; OR

(B) A PRODUCT THAT MAY BE PRODUCED FOR PERSONAL USE OR PRODUCED AND ADMINISTERED FOR NATURAL MEDICINE SERVICES PURSUANT TO AND IN COMPLIANCE WITH ARTICLE 170 OF TITLE 12,

SECTION 18-18-434, ARTICLE 50 OF TITLE 44, AND RULES ADOPTED PURSUANT TO SUCH PROVISIONS.

(c) "MINOR USER" MEANS A USER OF A SOCIAL MEDIA PLATFORM WHO IS UNDER EIGHTEEN YEARS OLD.

(d) "SOCIAL MEDIA PLATFORM" HAS THE MEANING SET FORTH IN SECTION 6-1-1601 (4).

SECTION 4. In Colorado Revised Statutes, 22-54-114, amend (1) as follows:

22-54-114. State public school fund.

(1) (a) There is hereby created in the office of the state treasurer a fund, separate from the general fund, to be known as the state public school fund. There THE FOLLOWING MONEY shall be credited to said THE STATE PUBLIC SCHOOL fund:

(I) The net balance of the public school income fund existing as of December 31, 1973, and all distributions from the state public school income fund thereafter made THEREAFTER;

(II) The state's share of all moneys MONEY received from the federal government pursuant to the provisions of section 34-63-102;

C.R.S.,

(III) MONEY RECEIVED AS FEES PURSUANT TO SECTION 6-1-1906 (2); and

(IV) Such additional moneys MONEY as shall be IS appropriated AS NECESSARY by the general assembly which are necessary to meet the state's share of the total program of all districts, funding for institute charter schools, and, for fiscal years prior to the 2007-08 fiscal year, the contingency reserve during the budget year.

(b) Moneys MONEY annually appropriated by the general assembly shall be transferred from the state general fund and credited to the state public school fund in four quarterly installments on July 1, September 30, December 31, and March 31 to assure ENSURE the availability of funds for the required distribution of state moneys MONEY to school districts and institute charter schools. Such THE quarterly installments shall be determined in accordance with estimates prepared by the department of education with respect to the required distribution of state moneys MONEY to school districts and institute charter schools.

SECTION 5.

Act subject to petition - effective date - applicability. (1) This act takes effect at 12:01 a.m. on the day following the expiration of the ninety-day period after final adjournment of the general assembly (August 12, 2026, if adjournment sine die is on May 13, 2026); except that, if a referendum petition is filed pursuant to section 1

(3) of article V of the state constitution against this act or an item, section, or part of this act within such period, then the act, item, section, or part will not take effect unless approved by the people at the general election to be held in November 2026 and, in such case, will take effect on the date of the official declaration of the vote thereon by the governor.

(2) This act applies to conduct occurring on or after the applicable effective date of this act.